Risk Management According to ISO/IEC 17025
The new clause added to the standard, is covering risks and opportunities associated with the laboratory activities. The updated version of the standard ISO/IEC 17025: 2017 lists significant areas of laboratory work. These activities include the integration of risk management processes into the organization’s decision-making processes Controls and quality assurance systems are designed to provide tools for managing various professional works. These systems provide tools for the regular examination of the activities that may affect the professional work processes, and the assimilation of the risk management system in the decision-making process. What does the Standard require (related to risk)?
8.5 Actions to address risks and opportunities 8.5.1 The laboratory shall consider the risks and opportunities associated with the laboratory activities in order to: a. give assurance that the management system achieves its intended results; b. enhance opportunities to achieve the purpose and objectives of the laboratory; c. prevent, or reduce, undesired impacts and potential failures in the laboratory activities; d. achieve improvement. 8.5.2 The laboratory shall plan: a. actions to address these risks and opportunities; b. how to: - integrate and implement the actions into its management 20
www.innolabmagazine.com
system;
- evaluate the effectiveness of these actions. Note: Although this document specifies that the organization plan actions to address risks, there is no requirement for formal methods for risk management or a documented risk management process. Laboratories can decide whether or not to develop a more extensive risk management methodology than is required by this document, e.g. through the application of other guidance or standards. 8.5.3 Actions taken to address risks and opportunities shall be proportional to the potential impact on the validity of laboratory results. Note 1: Options to address risks can include identifying and avoiding threats, taking risk in order to pursue an opportunity, eliminating the risk source, changing the likelihood or consequences, sharing the risk, or retaining risk by informed decision. Note 2: Opportunities can lead to expanding the scope of the laboratory activities, addressing new customers, using new technology and other possibilities to address customer needs - Addressing both risks and opportunities establishes a basis for increasing the effectiveness of the management system, achieving improved results and preventing negative effects. - The laboratory is responsible for deciding which risks and opportunities need to be addressed. There is no requirement for a formal process or documented procedure for risk management. 7.10 Nonconforming work 7.10.1 The laboratory shall have a procedure that shall be implemented
when any aspect of its laboratory activities or results of this work do not conform to its own procedures or the agreed requirements of the customer (e.g. equipment or environmental conditions are out of specified limits, results of monitoring fail to meet specified criteria). The procedure shall ensure that: a. the responsibilities and authorities for the management of nonconforming work are defined; b. actions (including halting or repeating of work and withholding of reports, as necessary) are based upon the risk levels established by the laboratory; c. an evaluation is made of the significance of the nonconforming work, including an impact analysis on previous results; d. a decision is taken on the acceptability of the nonconforming work; e. where necessary, the customer is notified and work is recalled; f. the responsibility for authorizing the resumption of work is defined. 8.6 Improvement 8.6.1 The laboratory shall identify and select opportunities for improvement and implement any necessary actions. Note: Opportunities for improvement can be identified through the review of the operational procedures, the use of the policies, overall objectives, audit results, corrective actions, management review, suggestions from personnel, risk assessment, analysis of data, and proficiency testing results. 8.6.2 The laboratory shall seek feedback, both positive and negative, from its customers. The